DATA PROCESSING AGREEMENT
This Data Processing Agreement (the "DPA") is made on [date] between [Controller legal name], with address at [address] (the "Controller"), and [Processor legal name], with address at [address] (the "Processor"). It forms part of the [main agreement name] dated [date] (the "Agreement").
1. Subject matter and duration
The Processor processes personal data on behalf of the Controller to provide [service] under the Agreement, for as long as the Agreement lasts.
2. Details of processing
Categories of data subjects: [customers, employees, users]. Categories of personal data: [names, contact details, account data, usage data]. Special categories: [none or list]. Nature and purpose: [hosting, storage, analysis, support].
3. Instructions
The Processor processes personal data only on the Controller's documented instructions, including this DPA and the Agreement, unless the law requires otherwise. In that case it tells the Controller first, unless that law forbids it. It will also tell the Controller if an instruction seems to break the law.
4. Confidentiality
The Processor ensures that people authorized to process the data are bound by confidentiality.
5. Security
The Processor applies the technical and organizational measures in Annex 2, including [encryption in transit and at rest, access control, backups, logging, staff training].
6. Subprocessors
The Controller authorizes the subprocessors listed in Annex 3. The Processor will give [number] days of notice before adding or replacing one, and the Controller may object on reasonable grounds. The Processor binds each subprocessor to the same data protection duties.
7. Assistance
The Processor helps the Controller answer requests from data subjects and meet its duties on security, breach notice and impact assessments, taking into account the nature of the processing.
8. Personal data breach
The Processor notifies the Controller without undue delay, and in any case within [number] hours, after becoming aware of a breach. The notice describes the breach, its likely effects and the measures taken.
9. International transfers
The Processor transfers personal data outside [region] only with [the Controller's approval and an approved transfer mechanism, such as standard contractual clauses].
10. Deletion or return
At the end of the services, the Processor will [delete or return] all personal data within [number] days and delete existing copies, unless the law requires storage.
11. Audits
The Processor makes available the information needed to show compliance with this DPA and allows audits by the Controller or an auditor it appoints, with [number] days of notice, [once per year].
12. Liability
Liability under this DPA follows the limits of the Agreement, unless the law requires otherwise.
13. Governing law and signature
This DPA is governed by the law that governs the Agreement. The parties agree to sign it electronically, with the same effect as a handwritten signature.
Annex 1. Details of processing. Annex 2. Security measures. Annex 3. Authorized subprocessors: [name] [location] [service].
Controller Name and title: ______________ Date: ______________ | Processor Name and title: ______________ Date: ______________ |